There are 2 variants:
When the virus is run, it hooks 1Ch, 21h, and 28h to infect any executable that is run by writing itself to the end of the file. The infection size varies in different files.
When the file is executed, the virus stores its name, and infects that file on INT 1Ch or INT 28h calls. So the virus infects the file not at the same moment when the file is executed, but with some delay.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
The virus hooks INT 9 and 13h for activation. When activated the virus changes the video mode, pages, cursor and mouse position, and displays the string "1st".
The virus contains the encrypted text strings: